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APOLLO EXPERIENCE REPORT 

GUIDANCE AND CONTROL SYSTEMS: 

AUTOMATED CONTROL SYSTEM FOR UNMANNED MISSION AS-201 

By Gene F. Holloway 
Lyndon B. Johnson Space Center 

SUMMARY 


An automated control system was developed to provide the event sequencing and 
backup attitude control for Apollo unmanned test flight AS-201. Existing flight- qualified 
components and electronic technologies were used in the automated control system 
design to meet the critical 14-month development schedule. The system design had the 
flexibility and the capability needed to reconfigure for changes in the mission event 
time line. This flexibility was demonstrated by incorporating changes in the programer 
event sequence for a new mission time line as late as 2 weeks before integrated testing 
started at the NASA John F. Kennedy Space Center. All system requirements of the 
automated control system were satisfactorily achieved with the successful accomplish- 
ment of the Apollo AS-201 test flight. 


INTRODUCTION 


The structure and heat-shield design of the Apollo command module (CM), 
although similar to those of the Mercury and Gemini spacecraft, had enough differences 
to require an unmanned test flight program. The primary objectives of the first 
unmanned Apollo supercircular mission, AS-201/spacecraft 009, were to demonstrate 
the command and service module (CSM)/Saturn IB (S-IB) structural integrity and to 
evaluate the heat-shield performance. An automated control system for unmanned 
flights was developed by the NASA and the CSM prime contractor to provide the auto- 
matic event sequencing for the spacecraft and to provide a real-time ground command 
interface for backup attitude control and sequencing. The development of the unmanned 
automated control system from the initial concepts to the operational flight is reviewed 
in this report. The experiences outlined have resulted in information useful for future 
unmanned test flight equipment design. 

As an aid to the reader, where necessary the original units of measure have been 
converted to the equivalent value in the Systeme International d'Unites (SI). The SI 
units are written first, and the original units are written parenthetically thereafter. 



SYSTEM OPERATION DESCRI PTION 


Unmanned flights were required to verify the CSM/S-IB structural integrity and 
to evaluate the CM heat-shield ablator performance. These first-order flight objectives 
were grouped with several other test objectives and subsystem performance evaluations 
that had to be demonstrated successfully before the spacecraft could be rated for 
manned flight. The automated control system (fig. 1) consisted of the automated com- 
mand control (ACC) unit, the radio command control (RCC) unit, the sequential timer, 
and the attitude reference system (ARS). The ACC, the RCC, the sequential timer, 
and the associated cable set were further identified as the control programer (CP). 

The ACC provided the event- sequencing functions to the various interfacing sub- 
systems as a function of mission- elapsed time. The events that caused output switching 
of other subsystems as a function of time are listed in table I. These event times were 
provided to the ACC by two timers developed for the Agena B program. The mission 
event times were preestablished by the flight plan and were adjustable in 0. 5-second 
increments to a 2498-second mission duration. One timer was for normal mission 
functions (table II) and was capable of providing 22 event settings. The other timer 
was for abort functioning and provided 14 event settings. 



Figure 1.- Automated control system functional interface block diagram. 
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TABLE I. - MISSION EVENT DESCRIPTION 


Event Result of event 

El Arm service propulsion subsystem (SPS) thrust solenoids 
E2 Plus-X translation 

E3 Stabilization control subsystem (SCS) entry mode enable 

E4 Minus 5-deg/sec pitch rate 

E6 Plus 5-deg/sec roll rate 

E7 CM/service module (SM) separation 

E8 Earth landing subsystem (ELS) activate 

E9 Uncage SCS gyros 

E10 SPS thrust OFF 

Ell Arm 0.05g backup 

E12 SPS thrust ON 

E13 S-IVB/spacecraft separation 

E14 Escape tower jettison fire 

E15 Launch escape motor fire 

E16 Transfer thrust OFF control 

E17 Tape recorders OFF 

E18 Tape recorders ON 

E22 Start environmental control subsystem glycol evaporator operation 

E23 First gimbal position set 

E24 Second gimbal position set 

E25 Gimbal motors start A 

E26 Gimbal motors start B 




TABLE II.* CONTROL PROGRAMER COMMANDS SEQUENCE FOR NORMAL MISSION TIME LINE 


Sequence 

Result of event 

Event 

Time from range 
zero, sec 

number 


Planned 

Actual 

1 

Start normal timer 

- 

652.7 

663.1 

2 

Tape recorders OFF 

E17 ON 

654.7 

665.2 

3 

S-IVB/spacecraft separation signal ON 

E13 ON 

832.7 

(a) 


Uncage SCS gyros 

E9 ON 

832.7 

843.2 

4 

S-IVB/spacecraft separation signal OFF 

E13 OFF 

836.2 

(a) 


PIus-X translation ON 

E2 ON 

836.2 

846.7 

5 

Plus-X translation OFF 

E2 OFF 

854.2 

864.6 

6 

Plus-X translation ON 

E2 ON 

1170.7 

1181.2 


First gimbal position set 

E23 ON 

1170.7 

(a) 

7 

Primary SPS gimbal motors ON 

E25 ON 

1185.7 

1196.1 

8 

Secondary SPS gimbal motors ON 

E26 ON 

1186.7 

(a) 


Remove primary motors ON command 

E25 OFF 

1186.7 

(a) 

9 

Remove secondary motors ON command 

E26 OFF 

1187.7 

(a) 

10 

Arm SPS thrust solenoids 

El ON 

1200.7 

1211.2 


SPS thrust on ON 

E12 ON 

1200.7 

1211.2 

11 

Tape recorders ON 

E18 ON 

1311.2 

1321.9 

12 

Plus-X translation. OFF 

E2 OFF 

1384.7 

1395.2 


SPS thrust on OFF 

E12 OFF 

1384.7 

1395.2 

13 

SPS thrust off ON (secondary source 
of SPS control) 

E10 ON 

1385.0 

1395.4 

14 

Plus-X translation ON 

E2 ON 

1385.2 

1395.7 


SPS thrust off OFF 

E10 OFF 

1385.2 

(b) 


Second gimbal position set 

E24 ON 

1385.2 

1395.7 

15 

SPS thrust on ON 

E12 ON 

1400.2 

1410.7 

16 

SPS thrust on OFF 

E12 OFF 

1410.2 

1420.7 


Plus-X translation OFF 

E2 OFF 

1410.2 

1420.7 

17 

Pitch rate (-5 deg/sec) ON 

E4 ON 

1413.7 

1424.1 

18 

Pitch rate (-5 deg/sec) OFF 

E4 OFF 

1431.7 

1442.1 

19 

CM/SM separation start 

E7 ON 

1443.7 

(a) 


SCS entry mode ON 

E3 ON 

1443.7 

1454.2 

20 

Pitch rate (-5 deg/sec) ON 

E4 ON 

1452.2 

1462.6 

21 

Pitch rate (-5 deg/sec) OFF 

E4 OFF 

1468.7 

1479.1 


Roll rate (+5 deg/sec) ON 

E6 ON 

1468.7 

1479.2 

22 

Roll rate (+5 deg/sec) OFF 

E6 OFF 

1504.7 

1515.1 


Arm 0 . 05g backup 

Ell ON 

1504.7 

(a) 


ELS activate 

E8 ON 

1504.7 

(b) 


a No measurement available to determine time. 

^Time could not be determined from intermittent data. 
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The timers used the spacecraft 400-hertz alternating- current power source to 
provide rotation to mechanisms using preset cams for the timing functions. The mini- 
mum interval between each event setting was 0. 5 second with an accuracy of ±0. 2 sec- 
ond. The maximum duration between the first and last events for an individual timer 
was 2498 seconds. Timer motor runup time was approximately 0. 1 second for power 
applications. Approximately 0.3 second was required for the end of timer motor rota- 
tion after power turnoff. 

The RCC unit of the CP provided the real-time ground control linkage between 
the updata link (UDL)/spacecraft radio command equipment (RCE) and the spacecraft 
operational subsystems (fig. 1). The RCC unit used input signals provided by the 
15 relay contacts of the RCE. These 15 RCE input signals, processed by the RCC 
internal relay logic, provided the control capability for 38 real-time commands. The 
RCC used relay driver networks to ensure that signals of marginal voltage levels from 
the UDL/RCE would be presented to the RCC logic relay solenoids at the proper ampli- 
tude and for the proper time period to accomplish the correct driving functions through 
the ACC and enable the onboard systems to carry out these commands. 

The detailed functional description of each ground command that was designed to 
be processed by the radio command controller is shown in table III. The functions are 
self-explanatory. The relay numbers noted in the descriptions are located in the 
spacecraft 009 functional integrated system schematics. 

The ARS consisted of a gyro package for providing backup attitude reference 
information to the mission control center. The downdata-link attitude reference 
measurements were displayed and compared in real time in the mission control center 
for establishing vehicle orientation and system performance. The ARS provided flight 
control personnel in the mission control center with adequate information on the CM 
attitude to enable them to uplink the ’’direct rotation” ground commands (ground com- 
mands 10 to 15) for specific time periods and thus to reorient the spacecraft. This 
control feature was designed for emergency backup ground control and was not used 
during the flight. 

The normal mission mode was inititated when the ACC received the "All S-IVB 
engines off” command from the Saturn IVB (S-IVB). This command is considered the 
first sequence of the normal mission time line (table II). The list of mission sequences 
contained in table II includes both planned and actual occurrence times. The event- 
switching accuracy was specified to be ±0.2 second, with the accuracy for four critical 
events — E4, E6, E10, and E12 (table I) — specified to be ±0. 1 second. A compari- 
son of mission sequence times for the AS- 201 mission shows that the S-IVB gave the 
actual "All S-IVB engines off” command (start normal timer) approximately 10. 5 sec- 
onds after the preplanned time (table n). This resulted in an actual flight time delay 
of 10. 5 seconds in the remaining sequences because the Agena B timer operates on 
preset cams. When the late start of the normal timer is considered, only one event 
varied more than 0. 1 second from the preset nominal. The variant event was 
sequence 11, "Tape recorders on, " which differed 0. 2 second from the preset nomi- 
nal. The measurement sample rates could have contributed to this error; however, 
the time was within the specification of 0. 2 second. 
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TABLE III. - GROUND COMMAND DESCRIPTION 




Relay type 

Function performed 



Latching 

Momentary 

®GC1 

Roll rate backup 

X 


Activates relays 23K21 (yaw axis roll rate transfer). 

19K1 (rate input transfer, roll), and 12K3 (cage roll 
gyro); inhibits +5-deg/sec ROLL RATE command; in- 
hibits +X TRANSLATION; and commands THRUST OFF 

GC2 

Pitch rate backup 

X 


Activates relays 25K1 (rate input transfer pitch) and 
12K1 (cage pitch gyro); inhibits ±5-deg/sec PITCH 
RATE command; inhibits +X TRANSLATION; and commands 
THRUST OFF 

GC3 

Yaw rate backup 

X 


Activates relays 23K1 (rate input transfer yaw) and 
12K2 (cage yaw gyro); inhibits +X TRANSLATION; 
and commands THRUST OFF 

GC4 

Roll channel quads B and D disable 

X 


Disables automatic commands to reaction control sub- 
system (RCS) jets 9, 10, 11, and 12 

GC5 

Pitch channel disable 

X 


Disables automatic commands to RCS jets 1, 2, 3, 
and 4 

GC6 

Yaw channel disable 

X 


Disables automatic commands to RCS jets 5, 6, 7, 
and 8 

GC? 

Roll attitude gyro interrupt 

X 


Activates relays 12K3 (cage roll gyro), 19K20 (pseu- 

dorate cutout), and 19K4 (reaction jet controller (RJC) 
attitude switching); inhibits +5-deg/sec ROLL RATE 
command; inhibits +X TRANSLATION; and commands 
THRUST OFF 

GC8 

Pitch attitude gyro interrupt 

X 


Activates relays 25K20 (pseudorate cutout), 25K4 (RJC 
attitude switching), and 12K1 (cage pitch gyro); in- 
hibits +5- deg/sec PITCH RATE command; inhibits +X 
TRANSLATION; and commands THRUST OFF 

GC9 

Yaw attitude gyro interrupt 

X 


Activates relays 23K20 (pseudorate cutout), 23K4 (RJC 
attitude switching), and 12K2 (cage yaw attitude gyro); 
inhibits +X TRANSLATION; and commands THRUST OFF 

GC10 

Direct rotation (positive pitch) I 


X 

Activates relays 25K18 (automatic control interrupt); 
activates RCS jets 1 and 3 through direct coils 
(not through jet select logic) 

GC 1 1 

Direct rotation (negative pitch) 


X 

Activates relays 25K18 (automatic control interrupt); 
activates RCS jets 2 and 4 through direct coils 
(not through jet select logic) 

GC12 

Direct rotation (positive yaw) 


X 

Activates relays 23K18 (automatic control interrupt); 
activates RCS jets 5 and 7 through direct coils 
(not through jet select logic) 

GC 13 

Direct rotation (negative yaw) 


X 

Activates relays 23K18 (automatic control interrupt); 
activates RCS jets 6 and 8 through direct coils 
(not through jet select logic) 

GC14 

Direct rotation (positive roll) 


X 

Activates relays 19K18 (automatic control interrupt); 
activates RCS jets 9, 11, 13, and 15 through direct 
coils (not through jet select logic) 

GC 15 

Direct rotation (negative roll) 


X 

Activates relays 19K18 (automatic control interrupt); 
activates RCS jets 10, 12, 14, and 16 through 
direct coils (not through jet select logic) 

GC 16 

Direct thrust ON 


X 

Activates relays 25K15, 23K15, 19K15 (pitch, yaw, and 
roll engine ignition) and 25K18 and 23K18 (automatic 
control interrupt, pitch and yaw); applies 28 V dc 
to high side; grounds the side of thrust coils; and 
is reset by GC17 


Ground command. 
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TABLE HI. - GROUND COMMAND DESCRIPTION - Concluded 


Code 

Command 

Relay type 

Function performed 

Latching 

Momentary 

GC17 

Direct thrust OFF 

X 


Deactivates relays 25K15, 23K15, 19K15 (pitch, yaw, 
and roll engine ignition) and 25K18 and 23K18 (auto- 
matic control interrupt, pitch and yaw); removes 
28-V dc power from high side of thrust coils; and is 
reset by GC16 

GC18 

Direct ullage 


X 

Activates relays 25K18 and 23K18 (automatic control 
interrupt, pitch and yaw); arms (and latches 
armed) the SCS integrator; activates RCS jets 1, 2, 
5, and 6 through direct coils (not through jet 
select logic) 

GC19 

SM quad A propellant OFF 


x 

Disables RCS jets 2, 3, 13, and 16 

GC20 

SM quad B propellant OFF 


X 

Disables RCS jets 6, 7, 9, and 12 

GC21 

SM quad C propellant OFF 


X 

Disables RCS jets 1, 4, 14, and 15 

GC22 

SM quad D propellant OFF 


X 

Disables RCS jets, 5, 8, 10, and 11 

GC23 

CM system A propellant OFF 


X 

Disables RCS jets 1, 2, 5, 8, 9, and 12 

GC24 

CM system B propellant OFF 


X 

Disables RCS jets 3, 4, 6, 7, 10, and 11 

GC25 

Abort 

X 


Before launch escape tower jettison, commands launch 
escape subsystem abort in master events sequence 
controller (MESC) and inhibits CP timers; after 
launch escape tower jettison but before S-IVB shutdown, 
starts SPS abort timer in CP and inhibits normal 
mission timer; after S-IVB shutdown, has no effect on 
spacecraft 

GC26 

ELS activate 

X 


Arms 7620-m (25 000 ft) barometric switch in ELS 

GC27 

Reset latch commands (except GC17) 


X 

Resets all latching ground commands except GC17 

GC28 

Roll channel quads A and C disable 

X 


Disables automatic command to RCS jets 13, 14, 15, 
and 16 

GC29 

O.OSg backup 

X 


Activates relays 12K1, 12K2 (cage gyro, pitch and yaw), 
25K4, 23K4 (RJC attitude switching, pitch and yaw), 
and 23K16 (roll to yaw coupling); inhibits ±5-deg/sec 
PITCH RATE command; inhibits +X TRANSLATION; and 
commands THRUST OFF 

GC30 

CM/SM separation and SCS entry mode 
enable 

X 


Activates relays 25K3, 23K3, 19K3 (attitude gyro 
accelerometer package attitude input pitch , yaw , 
and roll), 25K5, 23K5, and 19K5 (entry gain pitch, 
yaw, and roll); arms O.OSg switch; and starts CM/SM 
separation sequence in MESC 

GC31 

Launch escape tower jettison 

X 


Initiates escape tower jettison fire in MESC; arms 
abort timer; and starts backup tower jettison timer 
using the launch escape motor for jettison 

GC32 

SM quad B propellant ON 


X 

Enables RCS jets 6, 7, 9, and 12 

GC33 

SM quad C propellant ON 


X 

Enables RCS jets 1, 4, 14, and 15 

GC34 

SM quad D propellant ON 


X 

Enables RCS jets 5, 8, 10, and 11 

GC35 

SM quad A and CM system A propel- 
lant ON 


X 

Enables RCS jets, 2, 3, 13, and 16; enables CM jets 1, 
2. 5, 8, 9 and 12 


GC36 CM system B propellant ON 

GC37 Normal timer start 

GC38 S-IVB/ spacecraft separation and 

uncage gyros 


Enables CM jets 3, 4, 6, 7, 10, and 11 

Starts and latches normal timer on 

Deactivates relays 12K1, 12K2, and 12K3 (cage gyro 
pitch, yaw, and roll); enables -5-deg/sec PITCH 
RATE command, +5-deg/sec ROLL RATE command, and 
+X TRANSLATION; removes THRUST OFF command; and 
initiates S-IVB/spacecraft separation sequence in 
mission event sequencer 


















As planned for the first 16 mission sequences, the CSM was maintained at the 
attitude and relative orientation in space that was established by the Saturn instrument 
unit at the time of CSM/S-IVB separation. During the 18-second duration of 
sequences 17 and 18, precision torquing current was applied to the attitude gyros of 
the stabilization and control subsystem and the CSM was reoriented 90° (5 deg/sec for 
18 seconds = 90° ) in pitch. By this maneuver, the CSM was oriented for CM/service 
module (SM) separation. After separation (during sequences 20, 21, and 22), the CM 
orientation was changed 82.5° (5 deg/sec for 16.5 seconds = 82. 5° ) in pitch and 
180° (5 deg/sec for 36 seconds = 180° ) in roll to establish the reentry attitude for 
the CM. 


DESIGN USING EXISTING TECHNOLOGY 


The critical schedule requirements for the CP development necessitated the use 
of existing electronic technology. Whenever possible, existing components that had 
been used and qualified on other missile and space programs were used. 

Hermetically sealed, general-purpose, all-welded-construction, microminiature 
relays were used extensively to establish the circuit logic and switching for the CP. 

The 28- V dc relays were rated at 2, 3, or 10 amperes. The relays were typically 
arranged as shown in figure 2, in which relay contacts are configured in the normally 
open state. Similar redundant configurations were used with the relay contacts in the 
normally closed state. Both momentary and latching relays were used in the CP 
design. Momentary relays remain switched into the changed state configuration as long 
as the switching signal to the relay solenoid is applied. Latching relays retain their 
switched "set" change of state until an additional "reset” switching signal is applied 
to the relay solenoid. The relay configurations shown in figure 2 were used to effect 
the desired logic circuitry. 

The analysis of the mission-event criticality and its relative importance to the 
success of the mission determined the redundancy requirements of the circuit logic 
required to accomplish the mission event. A request for a definition of the require- 
ments of the system interface was submitted to each engineering design group affected, 
and specific redundancy requirements on an event -by -event basis for the mission were 
obtained. The design of the CP was then established in accordance with these mission 
redundancy requirements . The redundancy requirements were classified into the fol- 
lowing four general categories. 

1. Simplex (not redundant) - The output or real-time command function may fail 
either "on" or "off" because of a single component failure (fig. 2(a)). This circuitry 
was used for uncritical functions. 

2. Dual series (redundant) - The output or real-time command function shall not 
fail "on" as a result of any single component failure (fig. 2 (b)). This series redun- 
dancy was used to protect from a failure, an erroneous signal, or a noise pulse caus- 
ing the event to occur inadvertently. 
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(a) Simplex (not redundant). 



(b) Dual series (redundant). 



(c) Dual parallel (redundant). 



1 Relay B 


(d) Dual series, triply parallel 
(redundant). 

Figure 2. - Circuit logic and 
switching relays. 


3. Dual parallel (redundant) - The 
output or real-time command function shall 
not fail "off" as a result of any single com- 
ponent failure (fig. 2(c)). This parallel 
redundancy was used to ensure that impor- 
tant events occurred even after one failure. 

4. Dual series, triply parallel (re- 
dundant) - The output or real-time command 
function must respond correctly in the event 
of a single component failure (fig. 2(d)). 

This complex redundant network was used 
in mission-critical paths in which it was 
required that any single failure or any 
spurious signal would not cause the loss or 
premature actuation of the critical mission 
function. 

The Agena B timer was selected for 
the timing input to the CP because it was 
available off the shelf and had been flight 
qualified and successfully flown on 22 
Agena missions. Because an off-the-shelf 
design was selected, the time required for 
delivery of the first pair of timers was 
shortened to approximately 14 weeks. The 
timers were carefully evaluated by the NASA 
in September 1964 and were found to have 
been previously tested to requirements that 
equaled or exceeded the Apollo Program 
specifications; because of their successful 
flight history, the timers were considered 
qualified by similarity. However, additional 
confidence tests were performed during the 
prototype buildup. 


SCHEDULE-CRITICAL DEVELOPMENT 


The scheduled development period to 
support the Apollo spacecraft 009 subsystem 
installation date for the CP was 14 months. 
The vendor had to work on a compressed 
schedule to meet the CP delivery date. 

The vendor's schedule stipulated that 
only 2 weeks would be allowed between the 
breadboard hardware delivery and the pro- 
duction hardware delivery. This is an 


9 



impossible situation for a program in which the breadboard is to be evaluated and 
tested in the laboratory and the results of the evaluations are to be fed back into the 
production hardware design. To achieve the vendor schedule, the production hardware 
was manufactured in parallel with the breadboard evaluation. Any changes or modifi- 
cations, or both, to the production hardware resulting from the breadboard evaluation 
were costly in terms of price and schedule. 

The vendor’s electromagnetic interference (EMI) evaluation of the hardware was 
the first example of the high program cost associated with a critically close delivery 
schedule. The EMI tests on qualification unit 2 at the vendor facility disclosed that the 
high design sensitivity of the relay drivers in the CP RCC unit permitted triggering of 
the drivers by noise as well as by the radio command signals. A resistor- capacitor 
filter network was designed and added to each relay driver as a piggyback module to 
correct the EMI noise problem. The addition of the piggyback modules to the unit 
design required a specific vibration qualification program. 

The production unit 1 CP was delivered for spacecraft 009 subsystem installation 
in May 1965. Unit 1 was returned to the vendor facility in November 1965 to incor- 
porate the piggyback filter and other design modifications and to correct some failures 
observed during the test program. Two of the failures are explained as follows. 

1. During the qualification program, four tantalum wet-slug capacitors were 
subjected to reverse current and subsequently broke down because the test equipment 
had a higher electrical potential than that used on the qualification unit. The break- 
down was sometimes self-healing; however, the timing function or other design function 
was lost at the time of the capacitor breakdown. The reverse-current condition was 
corrected by replacing the affected capacitors in the flight unit, by evaluating the test 
equipment thoroughly, and by correcting the test equipment in the areas in which 
reverse voltages occurred. 

2. One diode failed during the qualification test program, and a similar diode 
failed during the vendor manufacturing buildup. By using X-ray techniques, it was 
determined that the diodes were contaminated by silver particles. It was presumed 
that silver pieces flaked off inside the diode case during vibration and thermal environ- 
ment testing and eventually caused the diodes to short out. Early in December 1965, 
the vendor X-rayed the CP unit 1 diodes and discovered 50 questionable diodes. The 
diodes were replaced with diodes from a supply without contamination, and the CP was 
redelivered to the NASA John F. Kennedy Space Center (KSC) on December 19, 1965. 

The test equipment fabricated for the CP consisted of a bench console to control 
the following functions: (1) load simulation, (2) radio command encoding, (3) power 
monitoring, (4) event simulation, (5) master clocking, and (6) channel control switch- 
ing. The bench test console consisted of a power monitor panel, a digital voltmeter, a 
digital comparator, four power supplies, an indicator control panel, a master clock, 
and a printer. This equipment provided the stimuli and sensors necessary to verify 
that the design requirements of the CP had been met and that the CP was functionally 
acceptable for installation in the Apollo spacecraft. 

The bench test console, in general, was too elaborate and too complex for the 
small production quantities of flight hardware and for the critically short delivery 
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schedules. Sufficient time was not allowed for proper qualification of this complex test 
equipment. To test the CP as a system, including the Agena B timers, the bench test 
console required a master clock to verify the timer-keyed events and to verify the 
internal timer delays of the RCC and of the automatic command controller. A printer 
was used with the test console to provide a tape record of the test times and the events, 
including the voltage levels that occurred at that time. 

The tape format (fig. 3) consisted of 16 columns of digits. Column 10, repre- 
senting the voltage potential, indicated voltage polarity, which was always positive. 

The first seven columns were digits reserved for the recorded event time, and the 
eighth column was blank. The digits in column 9 represented a code for the decimal- 
point placement for columns 11 to 15. Columns 11 to 15 were used for voltage read- 
ings. Column 16 remained blank as long as the test value was within specification, and 
this column had an asterisk if the test value were out of tolerance. The typical test 
tape sequence shown in figure 3 has an out-of -tolerance reading in row 2. The 
numeral ”2” in column 9 means the decimal point is two places to the right (between 
columns 12 and 13) or "32.00 volts. M Time increases from the bottom to the top of 
the tape. Several identical times may be recorded because of several events being 
keyed at one particular time. The test tape provides an accurate record of the test 
data that were used in establishing the end- item historical report for the CP. The end- 
item report was delivered with each subsystem and remained with the spacecraft as 
part of the acceptance data package. This lengthy description emphasizes the complex- 
ity of the test equipment used for a unit that had only one flight. 

The CP qualification test specification levels and the CP test plan were approved 
on July 1, 1965, and the vendor was ready to begin tests on August 10, 1965. Qualifi- 
cation tests officially began September 22, 1965, and were completed November 15, 
1965. 


The qualification test program was success oriented; no time was allowed for 
design correction of any possible test failures or any resulting retest. Therefore, 
when the relay driver problem was discovered on CP qualification unit 2, an additional 
requalification program was established in late November 1965. The unit with the 
piggyback filter modules was retested in the vibration environment and passed suc- 
cessfully. The other two significant areas of interest during the qualification test 
program were the back-biased tantalum capacitor and the silver-contaminated diode. 
These problems were resolved, and the CP was successfully qualified for Apollo flight. 

In spacecraft tests performed before 
the KSC integrated spacecraft tests, a pro- 
totype CP was used with the Agena B timers 
to provide the test sequencing. The CP 
successfully supported spacecraft testing, 
although there was much concern about its 
overall reliability. The fact that every 
redundant path of the CP could not be veri- 
fied during spacecraft testing prompted 
many studies. The schematics of the 
parallel, series, and multiparallel paths 
of the CP were examined in detail. Each 


Digit 


Tape readings 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 


0 1 2 9 3 1 0 
0 1 2 9 3 1 0 
0 1 2 4 3 1 0 
0 1 2 4 3 1 0 
0 1 2 4 3 1 0 


2 + 2 5 0 0 0 
2 + 3 2 0 0 0 
2 + 2 5 0 0 0 
2 + 2 5 0 0 0 
2 + 2 5 0 0 0 


Figure 3.- Typical test tape section. 
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path in which the redundant elements were not verified during spacecraft testing was 
noted, and the criticality to the mission success of a failure in each unverified path was 
determined. A decision was made to fly the hardware without further attempts to verify 
the redundancy in spacecraft testing because every redundant component in the CP had 
been verified during the bench acceptance test just before delivery to the KSC . 

The time line of the AS- 201 mission was not firmly established when the CP was 
delivered for spacecraft testing in May 1965. The prime contractor and the NASA 
developed a plan whereby the Agena B timers would be finally set and delivered to the 
KSC just before performance of integrated spacecraft tests. The vendor was notified 
by NASA of the flight time-line settings and delivered the timers to the KSC 2 weeks 
later. The delivery date for integrated testing was met, and testing was resumed at 
the KSC for the February 26, 1966, launch. The unmanned sequencing requirements 
on future programs should be placed in a software program in which sequences could 
be changed without affecting the hardware. 

The redundancy problem is of interest because the CP was not designed as two 
redundant systems (A and B), as was the Mercury, Gemini, and Apollo hardware. The 
CP used redundant internal logic and sometimes was triply or quadruply redundant. 

This CP redundancy design was theoretically more reliable than the two- system (A and 
B) design, but the CP redundancy was difficult to verify in the spacecraft. The problem 
was resolved, however, for the mission control programer (MCP) used for the later 
unmanned flights. 


FLIGHT HISTORY 


The first launch of a production Block I Apollo spacecraft using an S-IB booster 
was on February 26, 1966, at 11:12 a. m. eastern standard time. The total flight time 
was 37 minutes 19.7 seconds. The postlaunch report for mission AS- 201 states, ’’The 
control programer performed properly throughout the mission, although all events were 
delayed approximately 10 seconds from the nominal time line because of a late initiation 
signal from the launch vehicle. The attitude reference system performed as expected 
with relatively high gyro-drifts appearing under g-loads. ” Table II contains the event- 
by-event comparison of actual and planned times. The postlaunch report also states, 
’’The control programer performed nominally throughout the mission, providing a. 
series of commands in the correct sequence and at the proper times within the limits 
of the timer. ” The only significant deviation of the flight was separation of the 
CSM/lunar module adapter from the S-IVB 10 seconds later than predicted. This event 
was used as the key starting event for the normal timer in the CP; as a result, each 
event occurred approximately 10 seconds late throughout the mission. In another devi- 
ation, the recovery aid (high-frequency antenna) was deployed but the signals from the 
antenna were not received in the recovery area. Because the CP was a one-time 
design, it was not tested after flight; therefore, it is not known whether the signal to 
activate the high-frequency transmitter was sent. 
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CONCLUSIONS AND RECOMMENDATIONS 


The flight of the unmanned Apollo spacecraft 009 (mission AS-201) was success- 
ful. The flight and subsystem developmental objectives were met, and requirements of 
the automated control system were accomplished in meeting the flight test objectives. 

Possible improvements in the development of the automated control system are 
as follows. 

1. The mission should be defined early in the flight-planning stages to prevent 
mission changes from having a great effect on hardware design, resulting in costly 
changes. Late in the control programer development, the requirement for a high 
percentage of the real-time ground commands was deleted by ground control. The 
number of ground commands initially was 38. If this number could have been controlled 
and held to 31 in the initial design, the ground commands could have been initiated by 
direct relay closures in the radio command communications equipment, and the radio 
command controller unit of the control programer would have had a much simpler 
design. 

2. Schedule plans or other acceptable alternate plans should be established early 
in the program to provide schedule relief when required. The production hardware 
delivery date for the control programer was originally within 6 months of the contract 
authorization date. The delivery date did not allow sufficient time to deliver a product 
commensurate with the high Apollo reliability standards. An alternate schedule plan 
was established in which the Apollo test organization used a prototype test article con- 
trol programer to provide spacecraft switching during spacecraft 009 testing at the 
prime contractor facility. The point to be considered is that the alternate schedule 
plan, if required, should be established early enough to allow the subsystem supplier 
time to evaluate the breadboard properly, to develop and test the prototype properly, 
and to incorporate improvements from these developments into the production units. 

3. General-purpose test equipment that is as simple as possible should be used 
for research and development hardware of low production quantities. The use of simple 
test equipment would allow changes in the flight hardware design without greatly affect- 
ing the test equipment design. If a vendor is going to build only three or four units of 
an end-item, it would be well to apply the manpower to actual testing of the finished 
production items rather than to use the manpower in attempts to further improve and 
verify the automated test equipment in preparation for end-item testing. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, January 14, 1975 
914-50-30-01-72 
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